Query trees including or nodes for event filtering
Summary by NHIP
Event Filter Tree Merging
The method merges two filtering trees by combining their topmost OR nodes into a single output tree. Child nodes from both original trees are added as children to this resulting OR node to identify reportable events.
Claim Score by NHIP
Abstract
Filtering trees for selectively notifying subscribers of events are provided, and are constructed with OR nodes to substantially reduce their size. The filtering trees have nodes representing event variables that ultimately branch to leaf nodes thereunder, and the leaf nodes identify which of a set of queries are satisfied by an actual event. A mechanism recursively merges nodes of trees into a single tree, and uses OR nodes when nodes cannot be combined, to essentially add a parallel path in the resulting tree to traverse. Nodes that can be combined are those that represent the same event variable, and may have data points that are merged into a combined node. Threshold gains in efficiency may be evaluated to determine whether the original trees should be kept instead of the resulting tree.

Term
Term ended
Expired 7 May 2022, 4.4 years ago.
- Priority
- Filed
- Granted
- Expired
- Today
9 claims: 1 independent, 8 dependent
- 1Broadest claimClaim Score 17, narrow(NHIP)In a computer system having an event management system for detecting events as they occur and selectively reporting them to one or more subscriber applications, a method of combining first and second filtering trees usable for determining which detected events should be reported to the one or more subscriber events by merging the first and second filtering trees to create an output filter tree used to selectively report events, the method comprising:accessing first and second filtering trees used to determine whether an event detected by a computing system should be reported to one or more subscriber applications;determining that a first node at a topmost level of the first filtering tree is an OR node;determining that a second node at a topmost level of the second filtering tree is also an OR node;in response to determining that an OR node is at the topmost level of each of the first and second filtering trees, creating a single output filtering tree and storing it on computer readable storage media, the single output filtering tree providing a resulting OR node at a topmost level of the output filtering tree;and adding each child node of the first tree and each child of the second tree into the single output filtering tree as child nodes, and such that the single output filtering tree when traversed with actual event data, is configured to identify when an event corresponding to the actual event data is to be reported to the one or more subscriber applications, and wherein adding each child of the first tree and each child of the second tree comprises: merging each child node of the first tree with a child node of the second tree into a merged node when such nodes can be successfully combined, and adding to the single output filtering tree each merged node as a child node of the resulting OR node;adding to the single output filtering tree each child node of the first tree and each child node of the second tree that cannot be successfully combined as a child node of the resulting OR node;and after any child node of the first tree and the second filtering tree have been added to the output filtering tree in a merged node or as a child node of the resulting OR node, eliminating each child from further consideration for merging.
61 paragraphs in 6 sections, as filed
CROSS-REFERENCE TO RELATED APPLICATION
0001This application is a division of U.S. patent application Ser. No. 09/517,895, filed Mar. 3, 2000 now U.S. Pat. No. 6,918,124.
FIELD OF THE INVENTION
0002The present invention relates generally to computer systems, and more particularly to constructing filtering trees that can be traversed to determine whether an event, data, or another instance satisfies the terms of a query.
BACKGROUND OF THE INVENTION
0003Event detection in computer systems allows management software to reliably identify the components and configuration of a computer system, to respond to hardware failures, and/or to otherwise monitor and improve the operation of the system. The range of events that may be detected by computer systems and reported to management or other subscriber applications is essentially unlimited. Some examples of computer detectable events include disk drive activity and errors, installation or de-installation of hardware components, network server activities and failures, and network security breaches. Such events may be generated by event providers as they occur, or detected via a polling operation.
0004Events are often detected by drivers associated with hardware components, operating system software, and instrumentation specifically designed to monitor hardware or software. As the number of hardware components, the complexity of software, and the size of computer networks continues to increase, it has become increasingly difficult to create management and other applications that can become aware of the occurrence of events in hardware and software components in an efficient manner. For example, a typical application is not normally interested in being notified of every event that is detected in system or network, and thus some form of selective notification is needed to improve efficiency. At the same time, it is often critical that an application does not miss an event in which it is interested. As a result, the processes for detecting and reporting the occurrence of events have become increasingly important and complex.
0005U.S. patent application Ser. No. 09/175,592, entitled “Using Query Language for Provider and Subscriber Registrations,” filed Oct. 20, 1998, which is a continuation-in-part of U.S. patent application Ser. No. 09/158,171, hereby incorporated by reference herein in their entireties, describe anary (not necessarily binary) filtering trees which are efficiently used by an event filtering mechanism and/or event providers to selectively report events to event subscribers that have registered for notification of those events. The filtering trees are constructed from queries received from event subscribers, and arranged such that traversing one or more appropriate trees using actual parameters accompanying an event determines whether a query is satisfied, i.e., whether a given subscriber should be notified. Moreover, multiple trees may be merged into a single tree. In this manner, a relatively large numbers of queries may be evaluated in a single traversal of a single tree.
0006In general, the filtering trees are arranged as hierarchies of nodes, with parent nodes representing parameters, and each parent node capable of having multiple data points corresponding to the values of a parameter to be evaluated. Depending on the result of the evaluation against the actual parameter values for a given event instance, the parent node branches to an appropriate child node representing further parameters to be evaluated, or to a leaf node which specifies whether a query is (or which queries are) satisfied by the event parameters and actual values. The subscribers that correspond to the satisfied queries are then rapidly determined. Note that the nodes and/or data points may be strings or other values, for example, strings that represent hardware device types.
0007By way of example, the filtering mechanism may receive a query from an event subscriber, such as an application or operating system, instructing the filtering mechanism to notify the subscriber whenever particular type of modem is added (but no other types of modems or hardware). The event filtering mechanism may then construct or modify an existing filtering tree to filter events so as to find this query when this type of modem is detected. For example, such a tree may include a first-level node that branches to a lower node when hardware change events are detected. Below the hardware node, a second-level child node may be present with data points, one of which represents modems, and others which represent other types of hardware devices. Below the node that represents the general class of devices, and pointed to by the data point that represents modems, a third-level child node may include data points representing particular types of modems. The particular type of modem being queried for may point to a leaf node, for example, that lists the satisfied query (along with any other queries that are satisfied). Alternatively, the leaf node may list the subscribers to be notified, or a set of true/false values that correspond to a set of queries.
0008While the use of filtering trees is thus highly efficient in event filtering operations, a tree may grow exponentially when representing queries having multiple parameters. For example, consider a tree having a node with data points that represent many possible values for an “X” parameter, e.g., two, four, nine, sixteen and twenty-eight. Every “X” node may have multiple possible outcomes, e.g., if one “X” node represents the value of two, the node may branch three different ways for an actual parameter value, i.e., one branch to handle less than two, a second for equal to two, and a third for greater than two. Note that the “less than” branch of the next highest “X” data point (e.g., four) will point to the “greater” than branch of the nearest value below (e.g., two), whereby each level has 2n+1 possible outcomes (where n is the number of data points on a node). When multiple parameters are being evaluated, some or all of the “X” node outcomes may branch to a lower-level node representing a “Y” parameter. This node also has data points with 2n+1 possible outcomes, some or all of which may branch to nodes for evaluating a still lower-level “Z” parameter, and so on. While highly efficient to traverse, such a filtering tree may consume a significant amount of storage.
SUMMARY OF THE INVENTION
0009Briefly, the present invention provides a method of combining first and second filtering trees using OR nodes to reduce the size of the tree. The method operates by determining whether two nodes at a common level of each of the first and second trees are both OR nodes, and if so, a single resulting OR node of a single resultant filtering tree is provided. Each child node of the first tree that can be successfully combined with a child node of the second tree is merged into a merged node, and each merged node is added to the resulting OR node as a child node thereof. The merging is recursive, i.e., child nodes beneath a merged node are merged into a merged child node when they can be successfully combined. Child nodes of the first and second trees that cannot be successfully combined are added to the resulting OR node as a children.
0010If the nodes of the two trees are not both OR nodes, the nodes are further evaluated in that if one node is an OR node, the node that is not an OR node is treated as a single child of an OR node, and the children are merged and/or added to a single resultant OR node as described above. If neither node is an OR node, they are evaluated to determine if they represent a same event variable, in which event they are merged, e.g., by performing a union of a set of data points of each node, and merging children thereof.
0011Traversing the tree is also provided after receiving notification of an occurrence of an event, in order to determine at least one query satisfied by the event. When an OR node is reached, the traversal branches to a child node of the OR node, which is then evaluated against actual event information in order to branch to a leaf node (possibly through other child nodes) based on the result. The leaf node provides query information, e.g., which queries are satisfied (or which subscribers should be notified). The traversal may return to the OR node and branch to another child of the OR node in order to obtain additional query information from a leaf node reached via an evaluation of the other child node.
0012A tree data structure is also provided, including a first child node representing a first event parameter with at least two leaf nodes including query information under the first child node, and a second child node representing a second event parameter with at least two leaf nodes including query information thereunder. An OR node is a parent of the first and second child nodes, such that the first node is branched to by the OR node during a tree traversal, and the first node selectively branches to one of the leaf nodes thereunder based on an evaluation of actual event data to obtain first query information therefrom. The second node may also be branched to by the OR node during a tree traversal, and the second node selectively branches to one of the leaf nodes thereunder based on an evaluation of actual event data to obtain second query information therefrom. The child nodes may include data points for evaluating against actual event parameter values.
0013Other advantages will become apparent from the following detailed description when taken in conjunction with the drawings, in which:
BRIEF DESCRIPTION OF THE DRAWINGS
0014<figref idref="DRAWINGS">FIG. 1</figref> is a block diagram representing a computer system into which the present invention may be incorporated;
0015<figref idref="DRAWINGS">FIG. 2</figref> is a block diagram generally representing a suitable architecture for employing filtering trees for filtering events detected in a computer system and reporting the filtered events to an event subscriber;
0016<figref idref="DRAWINGS">FIG. 3</figref> is a block diagram generally representing components for constructing and using filtering trees in the architecture of <figref idref="DRAWINGS">FIG. 2</figref>;
0017<figref idref="DRAWINGS">FIG. 4</figref> is a diagram generally representing the merging of filtering trees representing multiple queries having multiple parameters without the use of an OR node into a single filtering tree;
0018<figref idref="DRAWINGS">FIG. 5</figref> is a diagram generally representing the merging of data points of two non-OR nodes representing the same event variable;
0019<figref idref="DRAWINGS">FIG. 6</figref> is a diagram generally representing the merging of filtering trees representing multiple queries having multiple parameters into a single filtering tree using an OR node in accordance with an aspect of the present invention;
0020<figref idref="DRAWINGS">FIGS. 7 and 8</figref> comprise a flow diagram generally representing logical steps when merging two trees in accordance with an aspect of the present invention;
0021<figref idref="DRAWINGS">FIG. 9</figref> is a flow diagram generally representing the merging of non-OR nodes; and
0022<figref idref="DRAWINGS">FIGS. 10 and 11</figref> are diagrams generally representing the merging of various types of trees.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
0000Exemplary Operating Environment
0023<figref idref="DRAWINGS">FIG. 1</figref> and the following discussion are intended to provide a brief general description of a suitable computing environment in which the invention may be implemented. Although not required, the invention will be described in the general context of computer-executable instructions, such as program modules, being executed by a personal computer. Generally, program modules include routines, programs, objects, components, data structures and the like that perform particular tasks or implement particular abstract data types.
0024Moreover, those skilled in the art will appreciate that the invention may be practiced with other computer system configurations, including hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers and the like. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.
0025With reference to <figref idref="DRAWINGS">FIG. 1</figref>, an exemplary system for implementing the invention includes a general purpose computing device in the form of a conventional personal computer <b>20</b> or the like, including a processing unit <b>21</b>, a system memory <b>22</b>, and a system bus <b>23</b> that couples various system components including the system memory to the processing unit <b>21</b>. The system bus <b>23</b> may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. The system memory includes read-only memory (ROM) <b>24</b> and random access memory (RAM) <b>25</b>. A basic input/output system <b>26</b> (BIOS), containing the basic routines that help to transfer information between elements within the personal computer <b>20</b>, such as during start-up, is stored in ROM <b>24</b>. The personal computer <b>20</b> may further include a hard disk drive <b>27</b> for reading from and writing to a hard disk, not shown, a magnetic disk drive <b>28</b> for reading from or writing to a removable magnetic disk <b>29</b>, and an optical disk drive <b>30</b> for reading from or writing to a removable optical disk <b>31</b> such as a CD-ROM or other optical media. The hard disk drive <b>27</b>, magnetic disk drive <b>28</b>, and optical disk drive <b>30</b> are connected to the system bus <b>23</b> by a hard disk drive interface <b>32</b>, a magnetic disk drive interface <b>33</b>, and an optical drive interface <b>34</b>, respectively. The drives and their associated computer-readable media provide non-volatile storage of computer readable instructions, data structures, program modules and other data for the personal computer <b>20</b>. Although the exemplary environment described herein employs a hard disk, a removable magnetic disk <b>29</b> and a removable optical disk <b>31</b>, it should be appreciated by those skilled in the art that other types of computer readable media which can store data that is accessible by a computer, such as magnetic cassettes, flash memory cards, digital video disks, Bernoulli cartridges, random access memories (RAMs), read-only memories (ROMs) and the like may also be used in the exemplary operating environment.
0026A number of program modules may be stored on the hard disk, magnetic disk <b>29</b>, optical disk <b>31</b>, ROM <b>24</b> or RAM <b>25</b>, including an operating system <b>35</b>, (such as Windows® 2000), one or more application programs <b>36</b>, other program modules <b>37</b> and program data <b>38</b>. A user may enter commands and information into the personal computer <b>20</b> through input devices such as a keyboard <b>40</b> and pointing device <b>42</b>. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner or the like. These and other input devices are often connected to the processing unit <b>21</b> through a serial port interface <b>46</b> that is coupled to the system bus, but may be connected by other interfaces, such as a parallel port, game port or universal serial bus (USB). A monitor <b>47</b> or other type of display device is also connected to the system bus <b>23</b> via an interface, such as a video adapter <b>48</b>. In addition to the monitor <b>47</b>, personal computers typically include other peripheral output devices (not shown), such as speakers and printers.
0027The personal computer <b>20</b> may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer <b>49</b>. The remote computer <b>49</b> may be another personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the personal computer <b>20</b>, although only a memory storage device <b>50</b> has been illustrated in <figref idref="DRAWINGS">FIG. 1</figref>. The logical connections depicted in <figref idref="DRAWINGS">FIG. 1</figref> include a local area network (LAN) <b>51</b> and a wide area network (WAN) <b>52</b>. Such networking environments are commonplace in offices, enterprise-wide computer networks, Intranets and the Internet.
0028When used in a LAN networking environment, the personal computer <b>20</b> is connected to the local network <b>51</b> through a network interface or adapter <b>53</b>. When used in a WAN networking environment, the personal computer <b>20</b> typically includes a modem <b>54</b> or other means for establishing communications over the wide area network <b>52</b>, such as the Internet. The modem <b>54</b>, which may be internal or external, is connected to the system bus <b>23</b> via the serial port interface <b>46</b>. In a networked environment, program modules depicted relative to the personal computer <b>20</b>, or portions thereof, may be stored in the remote memory storage device. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.
0000Query Trees for Event Filtering
0029<figref idref="DRAWINGS">FIG. 2</figref> is a schematic diagram depicting one embodiment of the invention in which the computer system <b>20</b> includes an object manager providing a standard interface for event subscribers and event providers. The object manager <b>60</b> of the computer system <b>20</b> includes a standard interface <b>62</b> via which it can communicate with one or more event subscribers <b>64</b><sub>1</sub>-<b>64</b><sub>n</sub>. The object manager <b>60</b> may also include other standard interfaces such as an interface <b>66</b> for communicating with one or more external event providers such as the external event provider <b>68</b>. The occurrence of events is reported to an event-filtering core <b>70</b> of the object manager <b>60</b> by drivers, (e.g., four drivers are shown, <b>72</b><sub>1</sub>-<b>72</b><sub>4</sub>), an SNMP provider <b>74</b> which may report events of a network <b>76</b>, an internal event provider <b>78</b>, the external event provider <b>68</b>, and/or other instrumentation.
0030The SNMP provider <b>74</b> reports the occurrence of events on a network, such as the network <b>76</b>, using a standard, well-known protocol. The internal provider <b>78</b> is internal in the sense that in general, it is integrated with object manager <b>60</b> and can communicate with other components of the object manager <b>60</b> without the use of a communications hub or similar hardware. Note that in the example shown herein, the SNMP provider <b>74</b> is another example of an internal event provider. When the object manager <b>60</b> is practiced in a Windows® 2000 environment, for example, internal providers <b>78</b> may include Win <b>32</b> event providers and Windows Management Instrumentation (WMI) providers.
0031Although the object manager <b>60</b> may include one or more internal providers as described above, the present invention is particularly useful for reporting events detected by one or more external event providers such as the external provider <b>68</b>. The external event provider <b>68</b> is external in the sense that it communicates with the object manager <b>60</b> via a communications link and the standardized interface <b>66</b>. The external provider <b>68</b> may be written and/or supplied by a third-party manufacturer that is different from the supplier of the object manager <b>60</b>. For example, any original equipment manufacturer (OEM) can extend the driver that controls the function of its hardware to include an external event provider <b>68</b> that can communicate with the object manager <b>60</b> via the standardized interface <b>66</b>. Indeed, the object manager <b>60</b> and the event-filtering core <b>70</b> allow events to be efficiently reported to event subscribers <b>64</b> without the manufacturers of external providers <b>68</b> and the manufacturers of the event subscribers having a detailed knowledge of one another.
0032As shown in the example of <figref idref="DRAWINGS">FIG. 2</figref>, events detected by the event drivers <b>72</b><sub>3 </sub>and <b>72</b><sub>4 </sub>are reported to the event-filtering core <b>70</b> by the internal provider <b>78</b>. Events detected by the event driver <b>72</b><sub>1 </sub>are reported by the external provider <b>68</b>, while events occurring on the network <b>76</b> are reported by the SNMP provider <b>74</b>. Note that the drivers <b>72</b><sub>1 </sub>and <b>72</b><sub>3</sub>-<b>72</b><sub>4 </sub>are examples of event-detection components. The systems of the invention can also report events detected by drivers or other instrumentation without the assistance of intermediate event providers via a polling operation as described below. For example, the driver <b>72</b><sub>3 </sub>has no associated event provider. Instead, the object manager <b>60</b> periodically communicates with (polls) the driver <b>72</b><sub>2 </sub>to learn of the occurrence of any events detected thereby.
0033In one embodiment of the invention, a schema repository <b>80</b> defines an object-oriented, hierarchical classification of event classes. The event classes allow the event-filtering core <b>70</b> to efficiently determine the scope of the events that are to be reported to the event subscribers <b>64</b><sub>1</sub>-<b>64</b><sub>n </sub>and the events that may be reported by event providers <b>68</b>, <b>74</b>, and <b>78</b>. The Common Information Model (CIM), generally described in U.S. patent application Ser. No. 09/020,146, assigned to the assignee of the present invention and herein incorporated by reference in its entirety, provides one suitable schema for use with the present invention.
0034Event providers <b>68</b>, <b>74</b>, and <b>78</b> send notifications to the event-filtering core <b>70</b> as an events occur, and the event-filtering core <b>70</b> then filters the events to identify those that are to be reported to one or more of the event subscribers <b>64</b><sub>1</sub>-<b>64</b><sub>n</sub>. In one embodiment, the filtering is conducted by comparing the event classes of the events and parameters of the events to event-filtering definitions, which may be written in a query language. The event classifications defined in schema repository gives context to query-based filtering definitions, thereby allowing the event-filtering core <b>70</b> to filter the events. Event filtering is described below.
0035<figref idref="DRAWINGS">FIG. 3</figref> further illustrates various features and components of the event-filtering core <b>70</b> of <figref idref="DRAWINGS">FIG. 2</figref>, including a suitable structure for constructing and traversing the filtering trees of the present invention. As generally depicted in <figref idref="DRAWINGS">FIG. 3</figref>, the event-filtering core <b>70</b> includes an event subscriber registrations repository <b>82</b> and a provider registrations repository <b>84</b>. When the event-filtering core <b>70</b> is initialized on a computer system <b>20</b> or when an event subscriber (<figref idref="DRAWINGS">FIG. 2</figref>) is installed, the event subscriber (e.g., <b>64</b><sub>1</sub>) registers an event-filtering definition in the form of one or more queries, as generally described below. Similarly, the event providers <b>68</b>, <b>74</b>, and <b>78</b> register at the provider registrations repository <b>84</b>. The registration may also include queries.
0036In keeping with the present invention, the event-filtering core <b>70</b> assembles one or more filtering trees <b>86</b> in a filtering module <b>88</b>. In general, one way in which the filtering trees <b>86</b> may be used is to compare a reported event against one or more event-filtering definitions associated with some or all of the event subscribers <b>64</b><sub>1</sub>-<b>64</b><sub>n</sub>. Moreover, each event provider may have an associated filtering tree <b>86</b> defined in the filtering module <b>88</b>. After comparing the reported events against the event-filtering definitions using the filtering trees <b>86</b>, any events satisfying the event-filtering definitions result in an event report <b>90</b> being sent to the appropriate event subscriber or subscribers.
0037Moreover, the filtering module <b>88</b> may include a polling module <b>92</b> for actively identifying when particular events have occurred. For example, if a computer system <b>20</b> includes a disk drive without an associated event provider, and an event subscriber has requested a report of events at the disk drive, the polling module <b>92</b> may periodically determine whether events of interest have occurred at the disk drive, and if so, provide a suitable notification.
0038<figref idref="DRAWINGS">FIG. 4</figref> shows the merging of two filtering trees T<b>1</b> and T<b>2</b>, into a single tree T<b>3</b>. As shown in <figref idref="DRAWINGS">FIG. 4</figref>, the tree T<b>1</b> has a one decision making (non-leaf) node <b>96</b><sub>1 </sub>including two data points of values two (2) and five (5). The tree T<b>1</b> is capable of handling the query Q<b>1</b>, provided by one or more subscribers requesting event notifications where some parameter X has a value greater than two, and the query Q<b>2</b>, provided by one or more subscribers requesting event notifications where the parameter X has a value less than five. Each data point has three branches therefrom to leaf nodes <b>98</b><sub>1</sub>-<b>98</b><sub>5</sub>, one leaf node for less than results, one for equal to results, and another for greater than results. Each leaf node specifies whether the query or queries represented by the tree T<b>1</b> is satisfied. For example, each leaf node in the tree T<b>1</b> has a “True” or “False” value for each query Q<b>1</b> or Q<b>2</b>, e.g., when reached, the leaf node <b>98</b><sub>1 </sub>indicates that Q<b>1</b> is false and Q<b>2</b> is true. Alternatively, the leaf nodes may list which queries are satisfied (e.g., the “True” ones, such that the leaf node <b>98</b><sub>1 </sub>would only identify “Q<b>2</b>”) or may list which subscriber should be notified. The general construction, operation and traversal of such filtering trees is also described in the aforementioned U.S. patent application Ser. Nos. 09/175,592 and 09/158,171.
0039To traverse such a tree T<b>1</b>, the actual “X” parameter value of an event is evaluated against the data points in the “X” node <b>961</b>. For example, if a value of two (X=2) accompanied the event notification, the node <b>96</b><sub>1 </sub>would branch to the leaf node <b>98</b><sub>2</sub>, which indicates that query Q<b>1</b> is false (since X equal to two is not greater than two) and that query Q<b>2</b> is true (since X has a value less than five). As can be appreciated, the branch taken is the data point or segment (e.g., between data points) that matches the parameter's actual value.
0040The tree T<b>2</b> shows a tree that handles a query Q<b>3</b> (X>2 AND Y<=5) with two different parameters, X and Y. Note that for an X value less than or equal to two, the X node <b>96</b><sub>2 </sub>branches to “False” a leaf node <b>98</b><sub>6 </sub>or <b>98</b><sub>7</sub>, respectively without evaluating the Y parameter, since the X value alone makes the query Q<b>3</b> false. Note that for efficiency, identical leaf nodes may be combined. If X is greater than two, however, the Y node <b>96</b><sub>3 </sub>is evaluated to determine whether the query Q<b>3</b> is satisfied.
0041As also represented in <figref idref="DRAWINGS">FIG. 4</figref>, trees such as the tree T<b>1</b> and the tree T<b>2</b> may be combined, especially if they share some common event variable that makes the combination beneficial. To this end, the set of data points of common event variables in the combined node comprises the union of the data points each node of that variable, with the leaf nodes expanded to store the additional information needed for providing a result for the additional queries.
0042By way of example of how two nodes representing the same event variable (e.g., “Z”) are merged, consider the node representations <b>100</b> and <b>102</b> shown in <figref idref="DRAWINGS">FIG. 5</figref>, where the node represented as <b>100</b> has data points <b>2</b>, <b>3</b>, <b>7</b> and <b>9</b> and the other node <b>102</b> has points <b>3</b>, <b>5</b>, <b>7</b>, and <b>13</b>. Both nodes represent the same event variable “Z.” A combined “Z” node <b>104</b> is made from the union of the data points, i.e., the resulting node <b>104</b> has data points <b>2</b>, <b>3</b>, <b>5</b>, <b>7</b>, <b>9</b> and <b>13</b>. Then, the combining procedure is applied to the children of the data points themselves (equal to) and the segments between the data points (the greater than, less than children). As shown in <figref idref="DRAWINGS">FIG. 5</figref>, wherein the child nodes (whether leaf nodes or representing a further event variable) below the node <b>102</b> are labeled N<b>1</b>-N<b>9</b> and the child nodes below the node <b>104</b> are labeled Na—Ni, there is only one child of each node to be combined for each data point/segment. Leaf nodes are ultimately combined with other leaf nodes to provide a result that identifies how (or which of) the queries are satisfied by the merged nodes.
0043Thus, returning to <figref idref="DRAWINGS">FIG. 4</figref>, the “X” node <b>96</b><sub>4 </sub>has the data points two and five (i.e., the union of two, five and two), and the leaf nodes <b>98</b><sub>11</sub>-<b>98</b><sub>21 </sub>are adjusted to provide a result for queries Q<b>1</b>, Q<b>2</b> and Q<b>3</b>. Note that for X values greater than two, appropriate “Y” nodes <b>96</b><sub>5</sub>-<b>96</b><sub>7 </sub>need to be evaluated to determine whether Q<b>3</b> is satisfied, and thus the combined leaf nodes <b>98</b><sub>13</sub>-<b>98</b><sub>21 </sub>are placed under such Y nodes <b>96</b><sub>5</sub>-<b>96</b><sub>7</sub>. As can be readily appreciated, trees may be combined into more and more complex trees to handle more queries, more variables and/or more values of those variables.
0000Query Trees Including or Nodes for Event Filtering
0044In accordance with one aspect of the present invention, there is provided an improved filtering tree, and method and system for constructing and traversing same, in which “OR” nodes are provided. The “OR” node results in a situation wherein a single tree may need to be traversed more than once (i.e., different parts thereof), however a lesser number of nodes are needed to represent the tree. For example, even though the exemplary queries are relatively very simple in <figref idref="DRAWINGS">FIG. 4</figref>, it is apparent that the “Y” parameter evaluation requires that separate “Y” nodes <b>96</b><sub>5</sub>-<b>96</b><sub>7 </sub>(that essentially perform the same comparison but have slightly different children) be provided in the tree. A more complex tree can grow substantially larger than that shown in <figref idref="DRAWINGS">FIG. 4</figref>, whereby the benefit of a single traversal is outweighed by the size of the tree.
0045As represented in <figref idref="DRAWINGS">FIG. 6</figref>, an improved (in terms of reduced size) tree T<b>4</b> is provided, and includes an “OR” node <b>108</b>. The OR node <b>108</b> provides a mechanism via which a tree can filter events to determine which queries are satisfied by the event, with but with fewer nodes than trees consisting of only non-OR nodes. Indeed, the tree T<b>4</b> provides the same results as the tree T<b>3</b>, but with fewer nodes.
0046To traverse the tree T<b>4</b>, the leftmost branch of the OR node <b>108</b> is taken first (for purposes of convenience, as any order is feasible). This branch reaches the “X” node <b>110</b> with data points two and five (the only other branch is to the “Y” node <b>112</b>, although more than two branches are possible). Depending on the actual value of the X parameter, the node <b>110</b> will branch to one of the leaf nodes <b>114</b><sub>1</sub>-<b>114</b><sub>5</sub>. It is possible that the X value alone will satisfy all of the queries Q<b>1</b>, Q<b>2</b> and Q<b>3</b>, in which event no other branches (e.g., the right branch) of the OR node need be taken. This is indicated in <figref idref="DRAWINGS">FIG. 6</figref> by the nodes <b>114</b><sub>1</sub>-<b>114</b><sub>2</sub>, wherein the results of all three queries are known via the X value alone.
0047However, not all of the results may be obtainable via the left branch, and for some events, the next branch (to the right) of the OR node need be taken. This is indicated in <figref idref="DRAWINGS">FIG. 6</figref> by the nodes <b>114</b><sub>3</sub>-<b>114</b><sub>5</sub>, wherein the results of all three queries are not known by the X value alone, but depend on another branch, as shown in <figref idref="DRAWINGS">FIG. 6</figref> by the underscore character (_) representing the missing information. When a leaf node is encountered that indicates the next branch needs to be taken, the known results are recorded, if any, and the process returns to the OR node to take the next branch. In the present example, this is the right branch to the “Y” node <b>112</b>, which may provide the missing information. Note that in this example, the leaf nodes <b>116</b><sub>1</sub>-<b>116</b><sub>3 </sub>of the “Y” node <b>112</b> include the missing information that is needed to determine whether the query Q<b>3</b> is satisfied, and the information regarding Q<b>1</b> and Q<b>2</b> is already known from traversing the leftmost branch. However, in other situations, a tree may have more than two branches under an OR node, and the needed information may need to be determined by traversing further branches. In such an event, the traversal process will continue to move to the next branch right, until the information is obtained.
0048Note that as shown in <figref idref="DRAWINGS">FIG. 6</figref>, a series of True/False values are used to represent, in order, whether the queries are satisfied by a given event. When all possible queries of an OR tree have a true or false answer therefor, no further branches need be taken. However, if instead the leaf nodes list only the satisfied (true) queries, (or subscribers to notify), then each branch may need to be taken to accumulate a complete set of satisfied queries. The traversal process will thus end when no more branches need to be traversed.
0049<figref idref="DRAWINGS">FIGS. 7-9</figref> generally describe how a tree with OR nodes is constructed, along with some general rules provided herein. When combining two evaluation trees to produce a single evaluation tree, the combination procedure proceeds recursively, that is, the root node of the first tree is combined with the root node of the second tree, and the process continues on to the children as directed. Also, an OR node cannot be a child of another OR node, as will become apparent below. Note that the combining procedure for two nodes (described above with respect to <figref idref="DRAWINGS">FIG. 5</figref> and below with respect to <figref idref="DRAWINGS">FIG. 9</figref>) may result in one of two outcomes, namely creation of a new, combined node, or a failure to combine, in which event an OR node is created with the two nodes as children.
0050Beginning at step <b>700</b> of <figref idref="DRAWINGS">FIG. 7</figref>, when combining nodes, a test is performed to determine if both nodes are OR nodes. If not, the process branches to step <b>702</b>, as described below. If both nodes are OR nodes, the combining procedure succeeds and returns an OR node, as shown in step <b>706</b>, and a first child or the first (OR) node is selected at step <b>708</b>. <figref idref="DRAWINGS">FIG. 10</figref> shows two OR nodes, one with child nodes A, B and C thereunder, and the other with trees of nodes A′, D and E thereunder, where the common letters in “A” and “A′” represent event variables that may be combined as described above. Thus, step <b>708</b> would select the “A” node.
0051As represented in steps <b>800</b>-<b>818</b> of <figref idref="DRAWINGS">FIG. 8</figref>, for every child of the first node, the procedure tests it against every child of the second node to see if the combining procedure for the two children would succeed. This is shown beginning at step <b>800</b>, wherein the first (non-eliminated) child of the second node, i.e., the A′ node, is selected. If the nodes can be combined as shown via step <b>802</b>, the node is combined (step <b>804</b> and <figref idref="DRAWINGS">FIG. 9</figref>), and the resulting combined node is added to the resulting OR node (that was provided at step <b>706</b>) at step <b>806</b>. Via step <b>808</b>, both children are then eliminated from the further consideration.
0052If more children are under the first OR node, e.g., the “B” node, (step <b>818</b>), then the next node of the first node is selected at step <b>820</b> and tested against the first non-eliminated child under the second OR node, e.g., the “D” node. If the nodes cannot be combined, step <b>802</b> branches to step <b>810</b> to select another node e.g., the “E” node at step <b>812</b>. The process repeats until no nodes remain under the second for possible combination thereof, as determined via step <b>810</b>. If the selected child of the first OR node cannot be combined with a child of the second OR node, the selected child of the first OR node is added to the resulting OR node at step <b>814</b>, and this child is eliminated from further consideration (step <b>816</b>). Steps <b>818</b> and <b>820</b> handle the selection of all non-eliminated children under the first node, such that the “C” node in the example of <figref idref="DRAWINGS">FIG. 10</figref> is selected, after which the combining process returns to step <b>800</b> to test the “C” node for possible combination with non-eliminated children of the second OR node. When each node has been tested against each other node, step <b>822</b> is executed to add any remaining non-eliminated nodes as children to the resulting OR node.
0053<figref idref="DRAWINGS">FIG. 9</figref> summarizes how non-OR nodes are combined, (as also described above with respect to <figref idref="DRAWINGS">FIG. 5</figref>). First, at step <b>900</b>, a node is created with the union of the data points of the two original nodes. Then, via steps <b>902</b>-<b>908</b>, for every point/segment in the resulting node, the combining procedure is recursively applied to the children of the first and second node that were responsible for the area covered by the selected segment/point. As described above, there is only one such child in the first node and one such child in the second node. The process is recursively applied to nodes at each level of the tree, i.e., child nodes below a merged node are merged into a child merged node, any children thereof are similarly merged when possible, and so forth.
0054Returning to step <b>700</b> of <figref idref="DRAWINGS">FIG. 7</figref>, if both nodes to be combined are not OR nodes, e.g., as shown in <figref idref="DRAWINGS">FIG. 10</figref>, then step <b>702</b> represents the determination as to whether one of the nodes is an OR node. If so, the non-OR node essentially is treated as a single-child of OR node, as generally shown in <figref idref="DRAWINGS">FIG. 11</figref>, wherein the dashed box indicates such a “virtual” OR node. Then, the combining procedure for two OR nodes is applied, as described above with reference to steps <b>706</b>-<b>818</b>.
0055If neither of the nodes to possibly combine are OR nodes, then step <b>710</b> tests whether the two nodes represent the same event variables. If not, there is nothing to be gained by combining them and the procedure fails for these nodes. Otherwise the process branches to step <b>712</b> (to <figref idref="DRAWINGS">FIG. 9</figref>) to combine these nodes as described above. In this manner, a OR node tree is constructed with combined nodes thereunder as appropriate, providing a reduced number of nodes.
0056Lastly, one extension to the above-described procedure compares the space savings obtained via the OR node tree with the size of the original, non-OR trees. This is accomplished by comparing the total number of nodes in the combined tree to the total number of nodes in the original trees. If the first number of nodes (in the combined tree) exceeds a certain percentage of the second number, and the first number of nodes is sufficiently large, the operation fails and the combined tree is discarded. For example, one system uses one-hundred and fifty percent (150%) and ten (10) nodes as the thresholds for evaluation.
0057As can be seen from the foregoing detailed description, there is provided a method and system for combining trees using OR nodes, and traversing those trees for event filtering. The system and method are efficient, flexible and provide numerous benefits including space savings in event and other types of filtering.
0058While the invention is susceptible to various modifications and alternative constructions, certain illustrated embodiments thereof are shown in the drawings and have been described above in detail. It should be understood, however, that there is no intention to limit the invention to the specific form or forms disclosed, but on the contrary, the intention is to cover all modifications, alternative constructions, and equivalents falling within the spirit and scope of the invention.
Contents6
13 sheets
Sheet 1 Sheet 2 Sheet 3 Sheet 4 Sheet 5 Sheet 6 Sheet 7 Sheet 8 Sheet 9 Sheet 10 Sheet 11 Sheet 12 Sheet 13
Every citation, both ways
| Document | Relation | Office | Cited during |
|---|---|---|---|
| US8805875B1 | Cited by | United States of America | Search report |
| US2024403328A1 | Cited by | United States of America | Search report |
| US2007198423A1 | Cited by | United States of America | Pre-grant |
| US2013073723A1 | Cited by | United States of America | Pre-grant |
| US12299006B2 | Cited by | United States of America | Search report |
| US9081873B1 | Cited by | United States of America | Applicant |
| WO2024249780A1 | Cited by | World Intellectual Property Organization (WIPO) | International search |
| US8713174B2 | Cited by | United States of America | Search report |
| US5666528A | Cites | United States of America | Applicant |
| US5850516A | Cites | United States of America | Search report |
| US5852826A | Cites | United States of America | Search report |
| US6253195B1 | Cites | United States of America | Applicant |
| US6366926B1 | Cites | United States of America | Applicant |
| US6405191B1 | Cites | United States of America | Applicant |
| US6438618B1 | Cites | United States of America | Applicant |
| US6493703B1 | Cites | United States of America | Applicant |
| US6848078B1 | Cites | United States of America | Search report |
| Ehab S. Al-Shaer, A Survey of Event Filtering Mechanisms for Dynamic Multi-point Applications, Sep. 11, 1996. | Non-patent | – | Search report |
| Ehab S. Al Shaer et al., A Survey of Event Filtering Mechanisms for Dynamic Multi-Point Application, Sep. 11, 1996. | Non-patent | – | Applicant |
| Ehab S. Al Shaer et al., High Performance Event Filtering for Distributed Dynamic Multi-Point Applications: Survey and Evaluation, 1997. | Non-patent | – | Applicant |
| William Ford, Data Structure With C++, 1997. | Non-patent | – | Applicant |
| Ehab S. Al-Shaer, A Survey of Event Filtering Mechanisms for Dynamic Multi-point Applications, Sep. 11, 1996. | Non-patent | – | Search report |
| Ehab S. Al Shaer et al., A Survey of Event Filtering Mechanisms for Dynamic Multi-Point Application, Sep. 11, 1996. | Non-patent | – | Third party observation |
| Ehab S. Al Shaer et al., High Performance Event Filtering for Distributed Dynamic Multi-Point Applications: Survey and Evaluation, 1997. | Non-patent | – | Third party observation |
| William Ford, Data Structure With C++, 1997. | Non-patent | – | Third party observation |
3 members in 1 office
Priority claims6
| Document | Office | Kind | Date |
|---|---|---|---|
| 51789500 | United States of America | A | |
| 51789500 | United States of America | A | |
| 66341003 | United States of America | A | |
| 09517895 | – | – | – |
| US20000517895 | – | – | – |
| US20030663410 | – | – | – |
Members3
| Document | Office | Kind | |
|---|---|---|---|
| US2004064758A1 | United States of America | A1 | |
| US6918124B1 | United States of America | B1 | |
| US7284245B2This record | United States of America | B2 |
36 transactions on the USPTO file
Allowed after 1 non-final rejection.
- Non-final rejections
- 1
- Final rejections
- 0
- RCEs
- 0
- Appeals
- 0
Over time
Point at a mark for the transactionTransactions
| Event | Code | |
|---|---|---|
| Expire PatentEXP. | EXP. | |
| Correspondence Address ChangeC.ADB | C.ADB | |
| Maintenance Fee Reminder MailedREM. | REM. | |
| Recordation of Patent Grant MailedPGM/ | PGM/ | |
| Patent Issue Date Used in PTA CalculationAllowedPTAC | PTAC | |
| Issue Notification MailedAllowedWPIR | WPIR | |
| Dispatch to FDCD1935 | D1935 | |
| Application Is Considered Ready for IssuePILS | PILS | |
| Response to Reasons for AllowanceREAS | REAS | |
| Issue Fee Payment VerifiedN084 | N084 | |
| Issue Fee Payment ReceivedIFEE | IFEE | |
| Mail Notice of AllowanceAllowedMN/=. | MN/=. | |
| Notice of Allowance Data Verification CompletedAllowedN/=. | N/=. | |
| Date Forwarded to ExaminerFWDX | FWDX | |
| Response after Non-Final ActionA... | A... | |
| Mail Non-Final RejectionNon-final rejectionMCTNF | MCTNF | |
| Non-Final RejectionNon-final rejectionCTNF | CTNF | |
| Correspondence Address ChangeC.AD | C.AD | |
| Change in Power of Attorney (May Include Associate POA)PA.. | PA.. | |
| Case Docketed to Examiner in GAUDOCK | DOCK | |
| Case Docketed to Examiner in GAUDOCK | DOCK | |
| IFW TSS Processing by Tech Center CompleteTSSCOMP | TSSCOMP | |
| Case Docketed to Examiner in GAUDOCK | DOCK | |
| Information Disclosure Statement consideredIDSC | IDSC | |
| Reference capture on IDSRCAP | RCAP | |
| Information Disclosure Statement (IDS) FiledM844 | M844 | |
| Information Disclosure Statement (IDS) FiledWIDS | WIDS | |
| Application Is Now CompleteCOMP | COMP | |
| Application Is Now CompleteCOMP | COMP | |
| Application Return from OIPEWROIPE | WROIPE | |
| Application Return TO OIPEROIPE | ROIPE | |
| Application Dispatched from OIPEOIPE | OIPE | |
| Cleared by OIPE CSRL194 | L194 | |
| IFW Scan & PACR Auto Security ReviewSCAN | SCAN | |
| Preliminary AmendmentA.PE | A.PE | |
| Initial Exam Team nnIEXX | IEXX |
2 recorded assignments at the USPTO, latest first
- Now
Now: Held by
MICROSOFT TECHNOLOGY LICENSING LLC - 2014-12-09
Assignment of assignors interest.
Ownership change- From
- MICROSOFT CORPMICROSOFT CORPORATION
- To
- MICROSOFT TECHNOLOGY LICENSING LLC
Recorded 2014-12-09, Signed 2014-10-14
- 2006-10-25
Assignment of assignors interest.
Ownership change- From
- MCCOLLUM RAYMOND WHUDIS IRENANOVIK LEV
- To
- MICROSOFT CORPMICROSOFT CORPORATION
Recorded 2006-10-25, Signed 2000-03-02
10 legal events, as the office reported them to INPADOC
Over the term
Point at a mark for the eventEvents
| Event | Code | |
|---|---|---|
| Lapsed due to failure to pay maintenance feeLapsedFP | FP | |
| Lapse for failure to pay maintenance feesLapsedPATENT EXPIRED FOR FAILURE TO PAY MAINTENANCE FEES (ORIGINAL EVENT CODE: EXP.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITYLAPS | LAPS | |
| Information on status: patent discontinuationPATENT EXPIRED DUE TO NONPAYMENT OF MAINTENANCE FEES UNDER 37 CFR 1.362STCH | STCH | |
| Fee payment procedureMAINTENANCE FEE REMINDER MAILED (ORIGINAL EVENT CODE: REM.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITYFEPP | FEPP | |
| Fee paymentFPAY | FPAY | |
| AssignmentAS | AS | |
| Fee paymentFPAY | FPAY | |
| Information on status: patent grantGrantedPATENTED CASESTCF | STCF | |
| Fee payment procedurePAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITYFEPP | FEPP | |
| AssignmentAS | AS |
Numbers
- Publication
- 07284245
- Publication, DOCDB
- 7284245
- Publication, EPODOC
- US7284245
- Application
- 10663410
- Application, DOCDB
- 66341003
- Application, EPODOC
- US20030663410
Titles
- English
- Query trees including or nodes for event filtering
Patent term adjustment
- A delay
- +795 daysthe office missed an examination deadline
- Net adjustment
- 795 days
Classification
- CPC, 5
- H04L41/0604
- G06F11/0709
- G06F11/0781
- G06F16/24568
- H04L41/0213
- IPC, 7
- G06F3 00
- G06F9 46
- H02H3 05
- H03K19 003
- H04B1 74
- H04L1 22
- H05K10 00
- USPC, 2
- 719310000
- 714E11025